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DECLARATION OF SETH SCHOEN 
I, Seth Schoen, declare and state as follows: 

l. Lam a Senior Staff Technologist with the Electronic Frontier 
Foundation (EFF). I am over eighteen years of age. I make this declaration on my 
own personal knowledge and if called upon to testify thereto, I could and would 
competently do so. 

2. I have worked with computers and computer networks for over a 
decade. I have published two peer-reviewed academic papers in the field of computer 
security, and been interviewed about computer networking and computer security in 
the national news media. I have testified about electronic communications systems in 
three courts and before the United States Sentencing Commission, and have 


submitted expert testimony concerning the analysis of BitTorrent file-sharing 


| networks to the federal courts in at least fifteen other matters. 


3. I was requested by Morgan Pietz, counsel for a putative J ohn Doe in the 
above-captioned action, to research and provide an objective response to several 
statements made in the Declaration of Joshua Chin in Support of Response to Order 
to Show Cause, which was filed on April 8, 2013, and to factual assertions in the 


oppositions to the Order to Show Cause. Specifically, I was asked to research and 


| respond to these issues: 


a. Whether the protocol described by Peter Hansmeier in his 
declaration in the above-captioned case is a reasonably accurate means of identifying 


the Internet Protocol (IP) addresses of computers involved in file-sharing using the 


| BitTorrent protocol. 


b. | Whether an incomplete download of a video file using BitTorrent 
results in the downloader having a viewable copy of the file. 
C. What the metadata associated with the documents filed by the 


plaintiffs in this action reveal about who was involved in their drafting. 
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4, In forming these opinions, I relied upon the Declarations of Peter 


Hansmeier filed in the above-captioned case (ECF No. 8-1) and in case 2:12-06662- 


| ODW (ECF No. 6-1); Brett L. Gibbs’ Response to the Order to Show Cause in the 


above-captioned case (ECF No. 49); the Declaration of Joshua Chin in Support of 
Response to Order to Show Cause (ECF No. 108-1); the pleadings, declarations, and 
exhibits filed in connection with the Court’s February 7, 2013 Order to Show Cause; 
certain other pleadings filed in the above-captioned case and in the related cases, all 
- of which were electronically filed on the CM/ECF system by Brett Gibbs’ CM/ECF 
account and are identified below; and the authorities I cite below. 

The Accuracy of Plaintiff’s Means of Identifying IP Addresses 

a: While the Hansmeier Declaration purports to describe the method by 
which the Plaintiffs in these consolidated cases identify the IP addresses of copyright 


infringers, the declarations omit information that I believe is material to a 


| determination of whether that method is reasonably accurate, 


6. For example, Mr. Hansmeier states that his software records the 


| “percent of the file downloaded by [his firm]’s software from the infringer’s 


| computer” (Hansmeier Decl. at 20), but also that his firm’s software “does not [...] 


allow me to [...] communicate with [the infringer’s] computer in any way” 


(Hansmeier Decl. at 21). It is thus unclear whether or to what extent the software 


| downloaded portions of the file from individual defendants, and Mr. Hansmeier did 


| not file this information with the Court, although he states that he has it on file 


(Hansmeier Decl. at 26). Similarly, it is unclear to what extent Mr. Hansmeier's 
software relied on information obtained from third-party BitTorrent trackers (which 
facilitate downloads) as opposed to information obtained by direct observation of 
and communication with defendants’ computers. 

i. These omitted details could be important because simple methods of 
attempting to locate copyright infringers can easily go awry. For example, in 2008, 


researchers from the University of Washington found that, given then-prevalent 
2 


Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 
| 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT 





Ca 





Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 4of11 Page ID 
| #:2791 


L | methods for investigating BitTorrent transfers, it was straightforward to frame 
2 | particular IP addresses for downloading files that they had not, in fact, ever 
. attempted to download. The researchers experimentally framed their own laser 
=| printer and succeeded in eliciting false allegations of copyright infringement against 
> | it. See Michael Piatek, Tadayoshi Kohno, and Arvind Krishnamurthy, “Challenges 
: and Directions for Monitoring P2P File Sharing Networks, or, Why My Printer 
7 | Received a DMCA Takedown Notice,” in Proceedings of the 3rd USENIX Workshop 
: on Hot Topics in Security, July 29, 2008, available at 
? http://www.usenix.org/event/hotsec08/tech/ full papers/piatek/piatek.pdf. 
8. I do not mean to suggest that Mr. Hansmeier is unable to gather or did 
LT not gather relevant information to support Plaintiff's allegations, including by 
Me techniques that avoid the pitfalls described by Piatek et al. However, paragraphs 20, 
Sy 25, and 26 of his declaration indicate that he filed with the Court only a small 
a summary portion of the information that he gathered. In paragraph 27, Mr. 
!5 | Hansmeier says he “personally observed” infringing transmissions; his statement that 
16 | his firm's software does not “communicate” with Defendants’ computers leaves 
17 | some ambiguity about the exact nature of this observation. 
” 9. Without more information about how Plaintiff gathers IP addresses and 
ee attribute infringing activity to them, it is my opinion that an investigation like 
20 | plaintiffs could result in the identification of IP addresses of computers that were 
| not actually participating in infringing filesharing activity, or that had not been 
22 | directly confirmed to have done so. 
23 The Usability of Partial Downloads 
24 | 10. BitTorrent divides each file into “pieces,” which are subregions of the 
file that are downloaded independently of one another. When a BitTorrent user 
ee begins downloading a file, the BitTorrent client software receives pieces of the file 
27 | from many other BitTorrent clients on the Internet. These pieces do not arrive in 
28 | order, as they would when using the Hypertext Transfer Protocol (HTTP) or File 
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| the downloader. For example, a partial video file containing gaps may be difficult to | 


regard the file as damaged or corrupt and stop the playback process. 


| some circumstances it may be used to play portions of incomplete or damaged files. 


| the beginning of the file is missing. 


| large video file with zero (null) bytes, which is the same condition as an incomplete 
| BitTorrent download that is missing the beginning of the file. VLC was not willing 
to play this file when I pressed the “Play” button. Although an expert could use 

| VLC, possibly in combination with other software, to locate and play intact video 

| data from later regions of the file, most users would probably consider this file 


/ useless and unplayable. 


Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 


Transfer Protocol (FTP). Thus, at any given point during a BitTorrent download, the 
user will have some portion of the data in the complete file, but that portion will 
almost certainly consist of pieces separated by numerous gaps. For example, when 
downloading a ten-minute video file, a BitTorrent client may receive a few seconds 
of minute six, followed by a portion of minute two, and so on. At some point, if the 
download progresses, the user will have a complete or substantially complete copy of 
the file. It is statistically unlikely that the user would have large contiguous portions 
of the video early in the download. 


11. An incomplete, interrupted BitTorrent download is often not useful to 


play through even if the majority of the file is present, both because the gaps may be 


disorienting to a human viewer and because they may cause computer software to 

12. Tagree with Mr. Chin that the VLC Player is powerful and that under 
However, gaps in a video file (such as those caused by an incomplete BitTorrent 
download) could still interrupt the playback. 


13. More significantly, VLC cannot easily play certain video file formats if 


14. I confirmed this by overwriting a small fraction of the beginning of a 


15. Because BitTorrent client software applications normally download 


pieces of the file in a completely random order, it is quite possible, even common, 
A 
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| for the beginning of a file to be missing even when a significant fraction of the file's 
- content has already been downloaded. This is an important contrast with other kinds 
: of downloads where a file is downloaded sequentially from beginning to end, such as 
4 an HTTP or FTP file download. Unlike these downloads, BitTorrent downloads do 
>| not happen in sequential order. 
6 16. Under the assumption that pieces are downloaded in a random order, 
v there is a certain probability of having received at least a specified amount of data 
: intact and contiguous at the beginning of the file. The probability of having at least 
? | the first b pieces of the file after downloading k out of n total pieces can be 
” calculated explicitly as 
1] | 
2 | ies 
r -Ta 
14 | ik : 
ID | where 
16 | 
17 | ca 
18 ly) yiix-yil 
- is the “choose” function from probability, indicating the number of distinct ways of 
ay choosing y objects from a set of x objects. The general pattern is that this probability 
al remains extremely low while a download is incomplete (even when a substantial 
22 majority of the file has been downloaded), and then grows quickly as the download 
- | nears completion. 
on 17. For example, consider a 60-minute video file of 300 megabytes in size 
4) | which is being distributed via a BitTorrent swarm. Suppose that the file has been 
ee divided into 1200 pieces of 256 kilobytes each. This graph shows the explicit 
ad | probability that a given downloader has obtained the first one minute (5 megabytes, 
ce | or twenty pieces) of contiguous video content, and hence can play through the first 
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minute of video without interruption, once the downloader has downloaded a 


specified number of pieces: 


Probability of At Least First Minute Intact 


0.8 | 
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; 18. Here is the corresponding graph for the ability to play the first 15 
, | seconds of this file (1.25 megabytes, or five pieces): 
3 
4 Probability of At Least First 15 Seconds Intact 
5 
6 | 
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10 | 2 
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18 
- | 19. Lhave heard that some BitTorrent clients could be set to prioritize 
a downloading the beginning of the file before other parts, but this is not, to my 
- knowledge, standard or default behavior in BitTorrent software because it would 
oa have a deleterious effect on the speed and efficiency of a BitTorrent swarm as a 
23 | 
whole. 
eet 20. According to the Hansmeier Declaration, Plaintiffs use “proprietary 
= forensic software to conduct an exhaustive real time ‘fingerprint’ of [a BitTorrent] 
ue swarm.” Hansmeier Decl. § 20. This statement, as well as Mr. Hansmeier's 
a observation that “while [his firm] detects an infringement at a particular instant, the 
ae infringer may, and likely is infringing at other times as well” (id. J 21), suggests that 
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Plaintiffs observe a swarm and a defendant’s participation in that swarm at a single 


moment in time. At any given moment, participants in the swarm will have 


| downloaded different amounts of data. 


21. Although Mr. Hansmeier states that “[o]nce obtaining a full version of 
the Video file, John Doe . . . shared pieces of that copyrighted Video file... with 
other individuals” (id. 27), it is unclear from his declaration whether Mr. 
Hansmeier observed that any given Doe did in fact obtain a full version of the video 


file, or whether Mr. Hansmeier was merely speculating that the Doe would 


| eventually obtain a full version. His testimony at § 21 that “0881 detects an 


infringement at a particular instant” suggests that his statement at q 27 about a 
particular Doe “obtain[ing] a full version” is speculative. 

22. Many BitTorrent downloads fail to complete or are interrupted. Thus, 
many of the computers observed to have a partial download at a given time will not 
complete the download and will not obtain a usable video file. Without more 


information about how the Plaintiffs determine the nature and extent of a Doe 


| defendant's downloading activity, it is my opinion that the investigation described in 


| the Hansmeier Declaration could result in the identification of IP addresses of 


computers that did not download a usable video file. 


23. Inhis declaration, Mr. Chin stated that “Use of the VLC Player has 


| produced up to five seconds or more of images from a video file that had been the 


| subject of no more than thirty seconds of downloading.” However, Mr. Chin did not 


specify how the VLC Player was used in that instance, nor what protocol was used to 


download the file. A file downloaded using HTTP, FTP, or another protocol that 


| downloads a file in linear fashion would, when interrupted, be more likely to result 


in a file directly usable by an unskilled user. If Mr. Chin was referring to an 


interrupted BitTorrent download, it is likely that the playback he described required 


| more than simply pressing “Play” in the VLC Player. 
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Authorship of Plaintiffs’ Filings 


24. Portable Document Format (PDF) files can contain metadata, including 
fields indicating the author’s name and the file’s creation and modification dates. 


25. Using the Xpdf software created by Glyph & Cog, LLC, I extracted the 


| metadata from several PDF files that were electronically filed using Brett Gibbs’ 


CM/ECEF account in the above-titled case, and in a few of the related cases. 
26. My analysis revealed that the following files’ were “created” by user 
“SHO”: 
¢ Memo iso P’s Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8- 
1, created Oct. 5, 2012) 
¢ Opposition to Ex Parte Application to Stay Pending Subpoena.pdf (ECF | 
No. 14, created November 30, 2012) 
¢ P’s Response to Ex Parte re Stay.pdf (ECF No. 16, created November 
30, 2012) 


27. My analysis revealed that the following files were “created” by user 


“SHO0S”: 


e P's Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8, created Oct. 
55,2012) 

¢ P’s Response in Opposition to Movant’s Notice of Related Cases.pdf 
(ECF No. 18, created Dec. 7, 2012) 

¢ P's Response in Opposition to Movant's Supplement to Notice of 
Related Cases Filed 12-14-12.pdf (ECF No. 21, created Dec. 14, 2012). 

And in AF Holdings, LLC v John Doe, No. 12-cv-5709: 
¢ P’s Response to OSC.pdf (ECF No. 10, created Nov. 1, 2012) 


| The specific titles of these files were assigned when they were downloaded from the CM/ECF 
system, however, I assume that the underlying PDF metadata is from the original file uploaded to 


1 the CM/ECF system by the electronic filer, Brett Gibbs. Except where otherwise indicated, ECF 
| numbers are from 2:12-cv-8333. 


9 
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28. My analysis revealed that the following files were “created” by user 


¢ Ps Sanctions Motion.pdf (ECF No. 22, created Dec. 17, 2012) 
¢ P's Response to Anonymous Doe Movant's Ex Parte Appl for Leave to 
Take Early Discovery and Stay.pdf (ECF No. 27, created Dec. 20, 2012) 
¢ Motion to Disqualify Judge Wright.pdf (ECF No. 35, created Dec. 30, 
2012) 
¢ Opp to Request for Leave to File Response to Motion to Disqualify.pdf 
(ECF No. 39, created Jan. 7, 2013) 
¢ Notice of Voluntary Dismissal.pdf (ECF No. 43, created Jan. 28, 2013). 
And in AF Holdings, LLC v. John Doe, No. 12-cv-6636: 
¢ P’s Response re Failure to Serve.pdf (ECF No. 15, created Dec. 27, 
2012) 
And in AF Holdings, LLC v. Chaz Forsyth, No. 12-cv-6669: 
¢ P’s Response re Failure to Serve.pdf (ECF No. 18, created Dec. 27, 
2012) 


I declare under penalty of perjury under the laws of the United States of 


America that the foregoing is true and correct. Executed on April 16, 2013 at San 


abe Lede 


Seth Schoen 


| Francisco, California. 
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